April 14, 2026

[cassidyjames]

We held our working group meeting at 1530 UTC.

Agenda

• Issue triage follow-up
• Software development lifecycle (SDLC) checklist

As always, please comment below for anything we missed, or shout it out in the Coop Discord channel and we can get it added.

[cassidyjames]

Notes

Issue triage

Done:

• removed content-proxy, fixed unbounded queries that made coop unusable when many tasks are loaded at once, and clarified axios changes (new PR that bumps the server)

• Any plans to switch from npm to pnpm? pnmp has features built-in that prevent security vulnerabilities

  • No plans, but can take a look and evaluate. Our concern focuses on the old packages that have been sitting in coop’s codebase with exposed vulns vs installing new packages that may be insecure

Priority for remaining tasks

• Migrate from Sequelize to Kysely #187 is highest priority since it covers our last remaining security issues
• Upgrade Tailwind CSS 3 to 4 #205 is P2 because it's pretty big; @julietshen to look into scoping it out
• @vinaysrao1 to look at Upgrade Express 4 to Express 5 #203 and Upgrade Helmet 4.x to 8.x #204

SDLC

P0s: Recommended order of operations

• Quality / Intention statement: @vinaysrao1, @julietshen, @cassidyjames to work on this

• Testing

  • Need to define our test coverage; start with services, then define different scenarios
  • Probably not in pre-commit hooks (makes committing painful!), but definitely in CI, and able to be run locally

• Release cadence - 12 month plan, esp with the roadmap and feature work in progress

• Dependency vulnerability process ← lowered because of recent work

• Documentation

  • Changelog: should include in-repo, could use changeset GitHub Action (also what Bluesky uses in atproto repo)
  • Conventions: commit messages, code style, etc.

Actions

• @vinaysrao1, @julietshen, @cassidyjames to work on quality/intention statement
• @julietshen to look into Tailwind upgrade
• @vinaysrao1 to look into Express and Helmet upgrades